Counts DHCP packets received on ports that are untrusted for server-role traffic -- i.e., packets that look like they're coming from a DHCP server role on a port not authorized to act as one. A nonzero and rising value here is a strong signal of a rogue DHCP server (intentional or a misconfigured customer router) attempting to answer client leases from an untrusted port, since legitimate server responses should only arrive on serverTrust/dualRoleTrust ports. If this jumps right after a new customer router is plugged in, that router is very likely acting as an unauthorized DHCP server on the access side.